Is this a legitimate way to do it? Is it totally wrong, or is there a better way? (With security-related code, I prefer to err on the side of caution.)

A previous attempt to set properties directly on the EM fails, in part because the EM is not a real EM but an EM wrapper class provided by the Glassfish container. (Glassfish 3.1.1 + EclipseLink 2.3 Indigo)

Using multiple EMF's or EM's is not really an option because then we lose all of the
JavaEE standard lifecycle stuff like transaction awareness, making sure the EM's are closed, etc.